The interest in Biometrics from both governments and industry has lead to the emergence of multiple Biometric technologies all with their own strengths and flaws. One currently at the forefront of Biometrics is iris scanning. The process involved in the identification and verification of people using iris scanning is examined in this paper. The advantages and disadvantages associated with the utilisation of such a technology are also explored. A number of legal and ethical issues are highlighted. Iris scanning is looked at in comparison to other forms of Biometric technologies. Future work in the area of Biometrics is also considered in light of current developments.

1. 1 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
BIOMETRICS: IRIS SCANNING
A Literature Review
WWW.OLIVIAMORAN.ME

2. 2 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
ABOUT THE
AUTHOR
Olivia Moran is a training specialist who specialises in E-Learning instructional design and is a
certified Moodle expert. She has been working as a trainer and course developer for 3 years
developing and delivery training courses for traditional classroom, blended learning and E-
learning.
Biometrics, Iris Scanning: A Literature Review was written as part of a group collaboration with
Barry Feehily and Eric Nichols.
WWW.OLIVIAMORAN.ME

3. 3 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
Abstract
The interest in Biometrics from both governments and industry has lead to the emergence of
multiple Biometric technologies all with their own strengths and flaws. One currently at the
forefront of Biometrics is iris scanning. The process involved in the identification and verification
of people using iris scanning is examined in this paper. The advantages and disadvantages
associated with the utilisation of such a technology are also explored. A number of legal and
ethical issues are highlighted. Iris scanning is looked at in comparison to other forms of Biometric
technologies. Future work in the area of Biometrics is also considered in light of current
developments.
Introduction
Over the past number of years, identity theft has evolved into a billion dollar industry. Pin
numbers and passwords just do not cut it anymore. They are no match against shoulder surfing
and card scanning. Developing new ways to protect information has become critical. Many have
turned to Biometrics making it one of the more popular alternatives. Biometric testing means
identifying a person on the basis of physiological and behavioural characteristics. According to
Prabhakar et al (2003) it enables “automatic personal recognition based on physiological or
behavioural characteristics”. The advances in technology in terms of processing power and cheaper
memory have also fueled interest in this area.
This article will examine Biometrics placing particular emphasis on remote iris scanning. It will take
an in-depth look at how such technology functions. The advantages and disadvantages that are
associated with it will also be highlighted. Ethical and legal considerations are addressed. A
comparison of iris scanning is made with other kinds of Biometrics. Possible areas for future
research and development are proposed.
How it Works
With the current state of iris recognition technology, Kanda (2005) states “Up to 20 people can be
recognised per minute if the scanning distance is within three metres and the subjects walking
speed is less than one metre per second”. There are various algorithms for iris scanning. Plemmons
et al (2004) describe eight different algorithms and write that they all share the same basic steps;
obtain the iris image, extract the features and compare to a database for a match.
Daugman (2004) algorithms are used in places such as British Telecom, US Sandia Labs, UK National
Physical Lab, NBTC, Panasonic, LG, Oki, EyeTicket, IBM SchipholGroup, Joh.Enschede, IriScan,
Iridian, and Sensar. He reports that while using his algorithms, “all testing organizations have
reported a false match rate of 0 in their tests, some of which involved millions of iris pairing”.
Daugmans’ algorithms in the context of the above three steps will now be examined.

4. 4 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
Step one involves obtaining the image. This step can only be successfully performed when people
being scanned look in the general direction of the scanner without blinking. Obtaining the iris
image involves scanning the eye for the iris boundary, the pupil boundary, and the upper and
lower eyelid boundaries, as shown in Figure 1. From these localisations the iris can be removed
from the rest of the eye and encoded.
Figure 1: Obtaining the iris image
(Daugman 2004, p.1)
Step two entails extracting the necessary features (i.e. encoding). It is done by scanning over the
entire iris “with many wavelet sizes, frequencies, and orientations, to extract 2,048 bits” Daugman
(2004). Each discrete item of extracted data contains two bits. Therefore there are 1,024 different
items of information encoded. This includes not only the iris, but also masking items such as
eyelashes that fall over the iris. As such, each eye is encoded with only 256 bytes.
Step three involves comparing the collected data to a database for a match. This comparison is
done with a fractional Hamming Distance. Daugmans’ (2004) version of the Hamming Distance
(HD) involves taking a scanned eye and applying an Exclusive OR to it and an item from the
database. The masking bits from the scanned eye and the eye in the database are the ANDed. They
are then ANDed with the items that were applied an Exclusive OR. The result is made positive and
then is divided by positive ANDed masking bits to produce the Hamming distance, as shown in the
following equation by Daugman in Figure 2:
Figure 2: Hamming Distance
(Daugman 2004, p.4)
When the HD is 0, then there is a perfect match between two irises. When the DH is 1, there is an
absolute mismatch. There must be a target for the comparator to resolve whether a match has
been made. Table 1 shows that a lower matching target results in less chance there will be a false
match:
Table 1: HD target result to false match (Daugman 2004, p.7)

5. 5 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
If a system were only concerned with false matches, then a target at or near zero for positive
identification would be desired. However, if a subject’s iris is more or less dilated, or if the subject’s
eye is slightly more closed or open, the mask will be different which will make the HD higher than
zero – even for the same iris. As such, a target HD of less than 0.30 on a world-wide scale would be
advised as this would ensure a positive match for the same iris while keeping the false matches at
less than 1 in 13 billion.
Advantages of Iris Scanning
There are a number of advantages associated with iris scanning. These include the following.
Uniqueness of the Iris
The iris of each person has a unique nature. Unlike with DNA “An iris image is independent of an
identical genetic makeup” Horst (2006). Take for example, identical twins that come from the
same embryo. Both will share the same DNA, yet evidence from research into iris imaging show
that “even irises of identical twins are different” Jain et al (2000). Some people even go as far as
to claim that “The iris is the most personally distinct feature of the human body” Kirsch (2006).
Red Herring (2006) report, “The odds of being misidentified by an iris scan, assuming both eyes are
used, are less than a trillion to one”.
Robustness
Iris scanning systems are more robust than other authentication methods such as face and voice
recognition. These systems can find it hard to cope with changes in the environment or the
person. For example, voice recognition may not work if the user is suffering from laryngitis or if
there is excessive background noise. Irish scanning eliminates this problem.
Accuracy
Accuracy is of crucial importance. People will not trust a system that gives wrong results. “An
inaccurate system could falsely identify a traveler as a terrorist, or give a false sense of security
while failing to identify a real terrorist” (Bryant 2001). Recently in a report entitled National
Institute of Justice Research Report on Entry-Control Technologies, it has been claimed, “iris
pattern scanners are considered the most accurate of all Biometrics” (Jarvis 2006). The accuracy of
iris scans is higher than that of its contemporaries.
Ease of Use
Remote iris scanning systems are relatively simple to use. While the user has to undergo enrolment
it is short and easy to complete. The acquisition of the iris image does not involve any intrusive
procedure. The user is not really required to interact with the system. The characteristics of the iris
are captured by simply glancing into a digital camera for a fraction of a second. Ease of use is
extremely important when it comes to gaining acceptance. If people feel that controls are too
annoying or time consuming they will simple override them. It is this ease of use that has proven a
huge success in US airports for both access control as well as passenger ticketing. It has also been
successful in use for ticketing at sporting events.

6. 6 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
Security
Remote iris scanning is more secure than other methods of identification such as pins and
passwords. These can be guessed and there exists the danger that someone could ‘shoulder surf’
you while you type it in. These identification methods also run the risk of been stolen should they
be written down and fall into the wrong hands. Fooling an iris scanning system is almost
impossible as it is “extremely difficult to surgically tamper iris texture information and it is easy to
detect artificial irises” Jain et al (2000). No other biometric technology can rival the combined
attributes of mathematical certainty.
Speed
Iris recognition is widely accepted as the fastest form of biometric testing and is suitable for use
where a large number of people are involved. Iris Scanning has been successfully deployed at
seventeen air, land and seaports in the United Arab Emirates (UAE). Border officials have scanned
the irises of 900,000 people whose visas have expired or who have been asked to leave the country.
Using those scans to screen arrivals has uncovered 650,000 illegal aliens trying to re-enter the UAE
using false passports. At Amsterdam Schiphol Airport, frequent travelers have been using iris scans
to speed up entry and immigration checks since 2001. There is no question that iris scanning is the
best choice where huge volumes of people need to be processed quickly.
Disadvantage of Iris Scanning
There are multiple weaknesses associated with iris scanning which need to be improved upon in
the future. These include the following.
Costs
One of the main reasons for slow adoption of Iris Scanning is the high cost currently associated
with the installation and maintenance of such technology. It is expected however, as the industry
matures and use of iris scanning becomes more wide spread, that costs will be reduced
significantly. As outlined by Torbet et al (1995), “Many biometric devices could be integrated with
the existing system, with the exception of the input sensor. This will reduce the cost and make
wide-scale adoption more likely”.
Acceptability
Users generally don’t like the unfamiliar. People are slow to adopt new technologies especially
when they see them as interfering with their privacy and confidentially. In order for iris scanning
to be acceptable its operation must be perceived by its potential users to be “at least as well, or
better, than any currently available alternative” Torbet et al (1995).
Fraudulent Use
Although the risk is relatively low the data collected during the iris scans could be used for fraud.
“Such fraud can occur at the enrolment stage as well as well as the verification stage” (Bennett
2000). During the enrolment phase someone may be able to set up a false template. Fraud can
also take place during the verification or identification stage. When the system scans the users iris

7. 7 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
the resulting data must be compared against the relevant template. This template is usually stored
in a central database. Therefore, data must be transmitted at this point. If this transmission is not
secure it is possible for others to intercept the information. They can then use it for whatever
purpose they wish.
Security
No system is one hundred percent accurate and that includes Biometrics. Although iris scanning
reduces the risks, there is always room for error. From the research conducted it is highlighted that
there is a False Rejection Rate, where the system rejects the right person and the False Acceptance
Rate, where the wrong person is accepted. The levels of these errors however are deemed to be
well under the acceptable level.
Industry Standards
As outlined by Emory (2002) “The development and acceptance of a primary standard is critical for
the growth and applicability of the biometrics industry”. While industry standards do exist, they
do leave room for improvement and are few and far between. The bigger more powerful
companies such as Microsoft refuse to conform in order to build a better product and they create
their own set of standards. The adoption of global standards would limit and minimise the abuse
of data collected. However, the adoption of standards is voluntary and not legally binding.
Legal Considerations
The rapid progression of the use of Biometrics and Iris Scanning has raised concerns from a legal
point of view, especially the legislation concerning privacy and the protection of data. From this
article it is clear that all Biometrics involves working with and processing data. As a result
Biometrics must comply with legal requirements that are currently in place. Take for example ‘The
Data Protection Act (1998)’ in Ireland. According to this act personal data should be collected for a
specific purpose and should be adequate, relevant and not excessive for the purpose for which it is
collected and processed. In addition it must be accurate and up to date. Appropriate security
measures must be in place to protect it. If a company is found to be in breech of the requirements
of this act they can be prosecuted.
Ethical Considerations
Disabled Users
Advocates of iris scanning market it as being the only system needed for authentication. This is
fine for most but what about the small group of people who do not have an iris? Obviously these
people cannot undergo iris scans. The exclusion of users with disabilities is not ethical nor is it
legal. We claim to be an inclusive modern society and yet little consideration is given to this
group. Using a mulitmodal system could overcome this limitation. Users could carry a smart card,
which would contain information about their lack of iris. The system could then permit an
override for this individual. Authentication could be done by some other means such as

8. 8 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
fingerprint or facial recognition. Such a multimodal system “offers higher and more consistent
performance levels” (Bennett 2000).
Privacy Concerns
One of the major concerns associated with the use of any Biometric system is privacy. There is a
threat to privacy and civil liberties because of potential for a wide range of people to cross-
reference information. People wish to keep their confidential information exactly that,
confidential. If we give all our information to a bank what is stopping them from selling this
information to a third party such as a marketing agency. Even worse what could the “Potential
impact that government might use of these technologies might have on personal freedom ... The
government could use some unforeseen technological advances to compile biometric records for
the real-time tracking of individuals” Wayman (2000). Currently such technologies are utilised in
many countries to find and track criminals. This could however be extended to cover the wider law
abiding population.
Up until now fingerprinting has been collected mainly for the use of law enforcement e.g.
criminals and this is a very sensitive issue for many people. However, it must be acknowledged that
iris scanning reduces the quantity of personal information that needs to be created and stored.
Iris Scanning Versus Other Forms of
Biometric Testing
Retina recognition relies on the retina’s blood vessel pattern. Unlike iris scanning, this technology
is personally invasive and requires skilled operators and time. Facial recognition examines
characteristics such as eyes, nose and mouth positioning taking into account the distances between
them. To date attempts to get computers to recognise faces have had only limited success. The
challenge here is producing hardware that will map the features of the face reliably and
accurately. Voice Recognition based on vocal characteristics is not intrusive, however, it is sensitive
to background noise and vulnerable to attack.
Today the fingerprinting is probably the most common form of Biometric technology used. This
involves matching minute features such as ridge and endings. While it is a widely accepted form of
Biometric testing it also has its drawbacks. The success of this process is highly sensitive to image
quality. Failure of this system can result from dirt and scars on the fingers along with poor finger
positioning. According to Matsumoto (2002) “Biometric samples or even templates may be
constructed, for instance artificial fingers may be used by attackers”.
As a result it is quite evident Iris Scanning offers advantages over alternative biometric techniques.

9. 9 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
Future Work
While iris scanning has been successful in providing a false match rate of zero, it has a weakness
that must be addressed. The system needs direct visual contact with every subjects’ iris for it to
operate. A person turning his or her head while talking to another could be a common occurrence
in a system that scans many people at once. People could also take advantage of this weakness.
An example is a locked door that needs iris identification in order for it to unlock. A person with
authority to pass could unlock the door with an iris scan. Before the door re-locks, people without
authority to pass through the door could close their eyes and also pass through before the door is
re-locked. The system would not be aware that an unauthorised person had breeched the security.
An additional security system such as a guard at the scanner would therefore be required. This is a
problem inherent in iris scanning.
In order to implement a better system technology would have to be utilised that could allow for
the remote identification of individuals. Such a system would not depend upon actions from those
individuals. Brainwave biometrics would provide this solution. Lawson (2002) notes that people
“cannot alter what is referred to as their baseline brainwave pattern”. Every person’s baseline
brainwave pattern is unique. From birth until death people broadcast unchanging and unique
waves from their brain. Technology that could receive and decode these waves would provide a
foolproof means of personal identification.
Future work in this area is needed from various fields. For instance, hardware would be needed
that is capable of receiving baseline brainwaves. The issue of storing individual’s brainwaves on
databases will need to be addressed. Algorithms would have to be developed to convert these
waves into a binary format. A way to compare the brainwaves so that a match can be immediately
found will also need to be implemented. There is plenty of future work to be done in this area.
Once such work is completed the best possible system of personal identification will have been
available for use.
Conclusion
In this document the area of Biometrics was critically examined focusing on iris scanning. The way
in which the entire iris scanning process works was illustrated. The benefits and shortcomings of
this particularly technology were addressed as well as the legal and ethical problems arising from
the use of such technology. Iris scanning was considered in relation to other technologies and
comparisons were made. Lastly, areas for future research and development were put forward.
Two important issues globally affecting the world today are identification and authentication of
an individual. Identification says who you are and authentication specifies that you are who you
say you are. From the research conducted it is quite evident that the use of Biometrics and iris
scanning for the above purpose is fast gaining worldwide recognition.

10. 10 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]
It is clear to see that Iris Scanning is a highly accurate and speedy form of Biometric Testing and is
suitable for use in many different situations especially where speed is essential e.g. airports.
However, the one major drawback at this time is its high implementation costs. With the
development of a more cost-effective system, it is anticipated that iris scanning will be used more
wide spread and it will gain a higher level of recognition in the future.
Biometric Technology also raises privacy-related concerns. Biometric systems must comply with the
principles of data protection legislation, since they create and process data, however, as Biometric
Technology is been widely implemented across the world, it is anticipated that countries will
update their laws to facilitate surveillance of this new technology.
Overall, especially after the tragic events of the attacks of the 11th of September 2001 and the
current fight against terrorism, it is likely that Biometrics and iris scanning will increasingly become
part of everyone’s life but like all other data collection and processing systems, it must be handled
with care. It will only be useful if the processes surrounding it are safe and secure.